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RELIEF SOUGHT 


The Defense requests this Court find that the above captioned Exhibits are inadmissible. 
The cited Prosecution Exhibits for Identification are properly excluded because they are hearsay, 
have not been properly authenticated, and are not relevant. 


Military Rule of Evidence (MRE) 401 defines relevant evidence as any having "any 
tendency to make the existence of any fact that is of consequence to the determination of the 
action more probable or less probable than it would be without the evidence." Pursuant to MRE 
402, relevant evidence is admissible, while irrelevant evidence is inadmissible. MRE 403 allows 
for the exclusion of admissible evidence where probative value is substantially outweighed by 
the danger of unfair prejudice or confusion of the issues. 

Hearsay is an out of court statement offered to prove the truth of the matter asserted. 
MRE 801(c). Hearsay is not admissible pursuant to MRE 802. 

MRE 901(a) requires that evidence be authenticated as a condition precedent to 
admission. Authentication requires "evidence sufficient to support a finding that the matter in 
question is what its proponent claims." Id. Such evidence may be provided through testimony 
from a witness with knowledge that a matter is what it claims to be. MRE 901(b)(1). 


Prosecution Exhibits for Identification 31, 32, 33, 34, and 109 should be excluded 
because they have not been properly authenticated, are hearsay, and are not relevant. 

I. THE EXHIBITS IN QUESTION HAVE NOT BEEN PROPERLY AUTHENTICATED 

In order for the Government to authenticate the Exhibits in question they must offer 
testimony from a person with knowledge about the actual site. MRE 901 . Specifically, the 
Government should be required to produce testimony from a person with knowledge about how 
the Wikileaks and Twitter websites appeared at a given time. Printouts from websites are not 
self-authenticating. In re Homestore.com., Inc. v. Securities Litigation, 347 F.Supp.2d 769 (CD. 
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Cal. 2004). As such, printouts from a website must be accompanied by an individual with 
personal knowledge of what a site looked like at a particular time, lei at 782-783. The court in 
St. Luke's Cataract & Laser Inst., PA. v. Sanderson, 2006 WL 1320242, at *2 (M.D.Fla. 2006) 
held that screen shots from archive.org (A.K.A. the "Wayback Machine") were properly 
authenticated when accompanied by affidavits from an employee of archive.org. This view is 
supported by the holding in Sam's Riverside, Inc. v. Intercon Solutions, Inc., 790 F.Supp.2d 965 
(S.D. Iowa 201 1), which held that an affidavit from an archive.org employee was sufficient to 
authenticate a screen shot from archive.org. Id. at 98 1 . However, an affidavit from archive.org 
only serves to authenticate the records of archive.org. It does not authenticate that a particular 
webpage looked a particular way on a particular day. See Enclosure 9, Archive.org FAQ. 1 

Web sites are "live," whereas caches reflect what something looked like at a single 
moment in time. Web sites can change frequently and may look different from one second or 
minute to the next. See Enclosure 1, Declaration of Trent Struttmann. Take, for example, 
CNN.com, which reports on the news. One could go to the site at 1200 and see a story about 
Congress, only to go back at 1201 and find that the death of a former President has taken over 
the page. A site like archive.org or Google cache only capture what a website looked like at a 
single moment in time. Again, consider a hypothetical scenario involving CNN.com. A story 
about a Supreme Court decision headlines the site at 1130, and Google cache or a third party 
contributor to archive.org saves the site at 1 145. The headline then changes at 1 146 when 
Congress passes a budget, and again at 1200 when a former President passes away. Because the 
Supreme Court decision headlined when the site was archived, that is how the page would appear 
on archive.org or Google cache. Now suppose Bob visited the site at 1 147. Despite what 
appears on archive.org or Google cache, Bob would not have seen the article on the Supreme 
Court decision. This scenario illustrates the inherent unreliability of online caches. Its reliability 
is only established if the Government can show that PFC Manning saw the exact site they wish 
this court to consider. 

Here, what the Government should be required to authenticate is not what appeared on a 
web cache, but rather what actually appeared on wikileaks.org, the website they allege PFC 
Manning visited. Absent testimony from an individual who viewed versions the Wikileaks Most 
Wanted lists in 2009, only an individual from wikileaks.org has the personal knowledge required 
to authenticate how the list looked at a particular time in 2009. The court in Novak v. Tucow's, 
Inc., 2007 U.S. Dist. LEXIS 21269 (E.D.N.Y. Mar. 26, 2007), supports this position. At issue in 
Novak was the admissibility of a number of printouts from the Wayback machine. The court 
held: 

While plaintiffs declaration purports to cure his inability to authenticate the 
documents printed from the internet, he in fact lacks the personal knowledge 
required to set forth with any certainty that the documents obtained via third- 
party websites are, in fact, what he proclaims them to be. This problem is even 
more acute in the case of documents procured through the Wayback Machine. 
Plaintiff states that the web pages archived within the Wayback Machine are 
based upon "data from third parties who compile the data by using software 
programs known as crawlers," who then "donate" such data to the Internet 
Archive, which "preserves and provides access to it ." (Novak Decl. ^ 4.) Based 


1 http://archive.org/legal/faq. php#wayback 
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upon Novak's assertions, it is clear that the information posted on the Wayback 
Machine is only as valid as the third-party donating the page decides to make 
it — the authorized owners and managers of the archived websites play no role in 
ensuring that the material posted in the Wayback Machine accurately represents 
what was posted on their official websites at the relevant time. As Novak 
proffers neither testimony nor sworn statements attesting to the authenticity of 
the contested web page exhibits by any employee of the companies hosting the 
sites from which plaintiff printed the pages, such exhibits cannot be 
authenticated as required under the Rules of Evidence, 

Id. at *5. It is clear from the Novak opinion that authentication must be done by an individual 
with personal knowledge of the actual site that posted the Wikileaks Most Wanted list or Tweet. 
That is, Wikileaks and Twitter. See also, Dollman v. Mast Indus., 201 1 U.S. Dist. LEXIS 99802, 
Footnote 1 (S.D.N. Y. Sept. 6, 201 1); Burchette v. Abercrombie & FitchStores, Inc., 2010 U.S. 
Dist. LEXIS 47043, Footnote 6 (S.D.N.Y. May 10, 2010); Audi AG v. Shokan Coaclmorks, Inc., 
592 F. Supp. 2d 246, 278 (N.D.N. Y 2008); Chamilia, LLC v. Pandora Jewelry, LLC, 2007 U.S. 
Dist. LEXIS 71246, Footnote 4 (S.D.N.Y. Sept. 24, 2007; Market-Alerts Pty., Ltd. v. Bloomberg 
Fin. L.P., 2013 U.S. Dist. LEXIS 15300, Footnote 12 (D. Del. Feb. 5, 2013); Crochet v. Wal- 
Mart Stores, Inc., 2012 U.S. Dist. LEXIS 18258, *12 (W.D. La. Feb. 13, 2012). 

The reliability of archive.org records can reasonably be questioned. Unlike the 
Government's affidavit, which, interestingly, is not on the standard archive.org affidavit form, 
the affidavit secured by the Defense establishes for the Court a thorough understanding of the 
Wayback Machine. The documents held by archive.org are documents obtained from third-party 
individuals donating the pages that they decide to make for archive.org. Archive.org plays no 
role in ensuring that the material posted and made available through archive.org accurately 
represents what was posted on a particular website at any particular time. As such, archive.org 
cannot state that documents are what they claim to be as they are not a person with knowledge of 
the events recorded within the documents on archive.org or that the documents are from the 
purported website. See Enclosure 10, Affidavit from archive.org. 

The Government has not suggested that PFC Manning saw the archive.org website; the 
Government's theory is that PFC Manning viewed the Wikileaks Most Wanted list directly from 
the Wikileaks webpage sometime in 2009. The affidavit from archive.org makes clear they have 
no personal knowledge as to what the Wikileaks website actually looked like at any given point 
in time. Rather, archive.org has personal knowledge of what a third party told them it looked 
like at a particular time. This cannot suffice for authentication in a criminal proceeding. While 
an individual's business or financial matters are important, they pale in comparison to an 
accused's right to due process. Because websites are so easily and routinely hacked (See 
Enclosures 4-8), the best evidence in this case is the testimony of someone from Wikileaks or 
Twitter who could testify about how a website looked at a given time. 

II. THE EXHIBITS IN QUESTION ARE HEARSAY 

Should the Court find that the Exhibits in question can be properly authenticated, they 
would be properly excluded as hearsay. Each of the proffered exhibits contains triple hearsay. 
First, there is the statement by the webpage itself, Wikileaks or Twitter. Second, is the statement 
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of the individual who allegedly captured the site and relayed the information to archive.org or 
Google cache. Finally, there is the statement of archive.org or Google cache. 2 

The Government has proffered that they intend to offer the exhibits for a non-hearsay 
purpose. Specifically, they indicated an intention to use the exhibits to show the effect on the 
listener, PFC Manning. In order for these exhibits to be admitted as non-hearsay the 
Government must be required to show that PFC Manning actually stnv (hem. For there to be an 
effect on a listener there must actually be a listener. The Government has offered no evidence 
that PFC Manning actually viewed Prosecution Exhibits for Identification 31-34 and 109. 

Predictably, there is little case law on this obvious matter. The Northern District of 
Illinois considered the issue in Brandon v. Village ofMaywood, 179 F.Supp.2d 847 (N.D. 111. 
2001). Brandon involved a plaintiff in a §1983 claim, an alleged drug dealer, being asked by 
two women whether he was working that day. The key question was whether police officers had 
reasonable suspicion that the accused was engaged in drug activity. The court found that unless 
the officers heard the question asked by the women it was not relevant and constituted hearsay. 
Id. at 856. The Supreme Court of New Mexico in New Mexico v. Rosales, 136 N.M. 25, 30 
(2004) followed suit, finding that evidence was properly excluded as hearsay when it could not 
be shown that one actually heard the out of court statement. 

The Government has failed to show that PFC Manning ever saw the websites in question. 
To date the only evidence offered by the Government to suggest PFC Manning saw a Most 
Wanted List were a trio of searches on Intelink and a passing reference in the Press Association 
chat about OpenSource.gov. Testimony from Special Agent Mark Mander showed that while 
PFC Manning did Intelink searches for three items on Prosecution Exhibit 1 10, there were 78 
items total on the list. Thus, PFC Manning didn 7 search for 75 of the items on Prosecution 
Exhibit 110. The Government also points to a handful of lines in the Press Association chat in 
which OpenSource.gov is referenced as proof that PFC Manning saw a list indicating Wikileaks 
wanted information from that site. In relying on these few lines the Government ignores critical 
facts. First, PFC Manning, was an all-source analyst whose job included scouring the web for 
information. Second, PFC Manning created an OpenSource.gov account prior to his first 
Intelink search for "Wikileaks" on 1 DEC 2009. See Enclosure X, stipulation of X. Obviously, 
he was aware OpenSource.gov prior to developing knowledge of Wikileaks. Finally, the chat 
itself involves Press Association telling PFC Manning they are interested in OpenSource.gov. 
Clearly, Press Association did not believe PFC Manning had seen the Most Wanted list or such a 
comment would have been unnecessary. Conspicuous in its absence in the chat conversation is 
any reference to the 2009 list by PFC Manning or Wikileaks. PFC Manning gives no indication 
to Press Association that he has seen such a list or is operating off of it, and Press Association 
gives no indication that they are directing PFC Manning to obtain an item of any 2009 list. 

Despite mountains of forensic evidence chronicling PFC Manning's computer activities 
in 2009 and 2010 there is no forensic evidence connecting PFC Manning with a Wikileaks Most 
Wanted List. To date we have heard extensive testimony from Special Agent David Shaver and 
Mr. Mark Johnson, who conducted forensics on PFC Manning's personal computer (Mac Book 


2 It is possible that the Exhibits involving Google cache are double hearsay. It is unclear whether Google 
relies on third parties to acquire the data used in their cache. 
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Pro), primary SIPR computer (.22), secondary SIPR computer (.40), tertiary SIPR computer 
(.185), and various other pieces of digital media. Both SA Shaver and Mr. Johnson have testified 
that, despite finding other connections to Wikileaks, there is no forensic connection between 
PFC Manning and a Wikileaks Most Wanted list. Furthermore, the Court has heard testimony 
about a number chats and emails involving PFC Manning. At no point during any of those 
conversations does PFC Manning or the individuals with whom he is conversing mention a 
Wikileaks Most Wanted list. 

Even assuming, arguendo, that the Court is persuaded by the Government's 
circumstantial evidence, the Government cannot demonstrate that PFC Manning saw the 
particular list the Government offers. A number of versions of the 2009 list have undoubtedly 
been available in some form or another on the WikiLeaks webpage based upon the versions that 
the Court has already been presented by the Government and the Defense. Based on the 
Government's scant evidence, it is no more likely that PFC Manning saw any one version of the 
list rather than another. Absent a showing that PFC Manning saw the particular Exhibit being 
offered, the Government has failed to establish PFC Manning as the "listener" required to 
establish non-hearsay admissibility of an Exhibit. 

III. THE EXHIBITS IN QUESTION ARE NOT RELEVANT 

Should the Court find that the proffered Exhibits are properly authenticated and qualify 
as non-hearsay, the Exhibits would be properly excluded as irrelevant. Nothing in any of the 
proffered exhibits would have given PFC Manning notice that Wikileaks was used by the enemy, 
nor do they make it more or less likely that he would have reason to believe release of the 
charged documents could cause harm to the United States or be used to the benefit of a foreign 
nation. To the contrary, assuming PFC Manning saw a version of the Wikileaks Most Wanted 
List, he would have seen that the documents were sought for the purpose of positive change. 
Moreover, the proffered Exhibits will not assist the Court in assessing the value of the charged 
documents for purposes of Specifications 4, 6, 8, 12, and 16 of Charge II. 

Even if the Court finds that the documents offered by the Government are marginally 
relevant, the documents would be properly excluded under MRE 403 .The probative value of 
these documents is limited. The Government cannot establish that PFC Manning saw any 
particular version of this list, nor can they establish the list was guiding PFC Manning's actions. 
As such, the proffered Exhibits are of minimal probative value. Consideration of the proffered 
Exhibits would unfairly prejudice PFC Manning by allowing the Government to argue a theory 
(PFC Manning was working for Wikileaks) that finds little, if any, support in the actual facts of 
this case, mischaracterizes the evidence and, looks to makes connections where not even 
reasonable inferences exist. Moreover, admission of the Exhibits would offend judicial economy 
and confuse the issues. The Defense will be required to explore in even greater detail with both 
Government and Defense computer experts whether PFC Manning saw the lists or Tweets in 
question. Whether or not PFC Manning saw any of the websites included in the Exhibits 
confuses the actual remaining issues; what did PFC Manning know at the time he provided 
documents to Wikileaks and what should he have reasonably known? Because the risk of unfair 
prejudice and confusion of the issues outweigh the probative value of the Exhibits they should be 
properly excluded under MRE 403. 
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CONCLUSION 


The Defense respectfully requests the Court exclude the Exhibits in question. 
Prosecution Exhibits for Identification 31 and 32 have not been properly authenticated because 
they come from cached websites. Moreover, both Exhibits constitute at least double hearsay for 
which no exception is applicable. Because the Government cannot prove that PFC Manning saw 
either Tweet, there could have been no effect on PFC Manning and the Exhibits do not qualify as 
non-hearsay. Finally, the Exhibits are not relevant, as they do not make a fact at issue more or 
less likely. 

Prosecution Exhibits for Identification 33, 34, and 109 should also be excluded, as the 
Government has failed to properly authenticate the webpages contained therein. The 
Government has offered no testimony from anyone with personal knowledge of what the sites 
actually looked like. Rather, they have offered only an affidavit from an individual who merely 
has personal knowledge of what a third party told him the sites looked like at a particular time. 
As such, the Exhibits constitute hearsay. Again, because the Government has failed to offer 
proof that PFC Manning actually saw the websites in question, the Government should not be 
permitted to smuggle hearsay into this proceeding for an alleged non-hearsay purpose. As with 
Prosecution Exhibits for Identification 31 and 32, Prosecution Exhibits for Identification 33, 34, 
and 109 are not relevant. They make no fact at issue more or less likely, and, as such, should be 
properly excluded. 


I certify that I served or caused to be served a true copy of the above on MAJ Ashden 
Fein, via electronic mail, on 15 June 2013. 


JOSHUA J. TOD 
CPT, JA 
Defense Counsel 




CPT, JA 
Defense Counsel 
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